Docker、Kubernetes安装系列二

一、导读

环境：openEuler 22.03、Linux 5.10、docker 25.0.0、VMware 17、kubeadm 1.30.14

背景：在线安装kubeadm，测试环境用

时间：20260903

说明：一键部署docker，后续部署kubeadm，仅在主节点安装，记录安装过程

二、部署docker、containerd

1、部署docker

bash 复制代码

# 上传文件压缩包
[jack@localhost ~]$ ls
docker-amd64-25.0.0.tgz 
[jack@localhost ~]$ tar xzf docker-amd64-25.0.0.tgz 
# 略
[jack@localhost ~]$ cd docker-install/
# 普通用户一键部署
[jack@localhost docker-install]$ sudo ./install.sh 
[sudo] jack 的密码：
[INFO]  ======== 开始部署 Docker 25.0.0 (静态二进制) ========
[INFO]  执行前置检查...
[ OK ]  前置检查通过。
[ 略 ]  ----------------------------------
Docker version 25.0.0, build e758fe5
[ OK ]  docker 服务正在运行。

[ OK ]  ======== Docker 部署完成! ========

[INFO]  后续建议:
  - 若以普通用户通过 sudo 部署,请重新登录(或执行 newgrp docker)后再使用 docker。
  - 验证命令:docker run --rm hello-world
  - 服务管理:sudo systemctl {start|stop|restart|status} docker
[jack@localhost docker-install]$ docker ps
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json": dial unix /var/run/docker.sock: connect: permission denied
# 将当前用户的会话组临时切换为 docker 组
[jack@localhost docker-install]$ newgrp docker


Welcome to 5.10.0-60.18.0.50.oe2203.x86_64

System information as of time:  2026年 09月 02日 星期三 14:03:05 CST

System load:    0.01
Processes:  247
Memory used:    9.2%
Swap used:  0%
Usage On:   17%
IP address:     192.168.46.128
IP address:     172.17.0.1
Users online:   4
To run a command as administrator(user "root"),use "sudo <command>".
[jack@localhost docker-install]$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

2、修改containerd配置

bash 复制代码

# 生成containerd默认配置文件
sudo mkdir -p /etc/containerd
sudo containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
# 修改registry.k8s.io/pause为阿里云环境
sudo sed -i 's|sandbox_image = "registry.k8s.io/pause:.*"|sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9"|' /etc/containerd/config.toml

之所以修改为3.9版本，是因为kubeadm的1.30.14版本默认是pause:3.9

重载和重启

bash 复制代码

sudo systemctl daemon-reload
sudo systemctl restart containerd

三、安装kube

1、初始化配置

bash 复制代码

# 停止防火墙服务
sudo systemctl stop firewalld.service
# 禁止防火墙开机启动
sudo systemctl disable firewalld.service
# 临时关闭 SELinux（当前会话生效）
sudo setenforce 0
# 永久关闭 SELinux（重启后生效）
sudo sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
# 临时关闭 Swap（当前会话生效）
sudo swapoff -a
# 永久关闭 Swap（注释 Swap 挂载项，重启后生效）
sudo sed -i '/swap/s/^/#/g' /etc/fstab
# 安装必要软件与ipvs管理软件（ipset 自带）
sudo yum install ipvsadm -y

2、加载内核模块

bash 复制代码

# 编写加载文件
cat <<EOF | sudo tee /etc/sysconfig/modules/ipvs.modules
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack
EOF
# 添加执行权限
sudo  chmod +x /etc/sysconfig/modules/ipvs.modules
# 执行命令，加载内核模块
sudo /bin/bash /etc/sysconfig/modules/ipvs.modules
# 检查是否加载成功
lsmod | grep -e ip_vs -e nf_conntrack

# 内核模块是否加载
lsmod | grep br_netfilter
# 加载内核模块
modprobe br_netfilter

3、配置kubernetes网络相关

添加配置文件

bash 复制代码

cat <<EOF | sudo tee /etc/sysctl.d/kubernetes.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF

使其生效

bash 复制代码

sudo sysctl -p /etc/sysctl.d/kubernetes.conf

4、配置kubernetes的仓库

bash 复制代码

cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.30/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.30/rpm/repodata/repomd.xml.key
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
EOF

5、指定kubelet配置

也可以在安装kubelet后，再配置，不影响

bash 复制代码

cat <<EOF | sudo tee /etc/sysconfig/kubelet
# 指定cgroup使用systemd
KUBELET_CGROUP_ARGS="--cgroup-driver=systemd"
# 指定代理使用ipvs
KUBE_PROXY_MODE="ipvs"
EOF

安装 kubelet kubeadm kubectl

bash 复制代码

# 安装相应的包
sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
# 在设置开机自启的同时，立即启动 kubelet 服务
sudo systemctl enable --now kubelet

6、containerd服务插件

kubeadm默认的位置在/opt/cni/bin/，而openEuler不在此处，查找并配置软连接

bash 复制代码

[jack@localhost ~]$ rpm -ql containernetworking-plugins | grep loopback
/usr/libexec/cni/loopback
[jack@localhost ~]$ ls /usr/libexec/cni/
bandwidth  bridge  cni  dhcp  firewall  host-device  host-local  ipvlan  loopback  macvlan  portmap  ptp  sample  sbr  static  tuning  vlan  vrf

创建目录，并创建软链（复制也可以）

bash 复制代码

# 创建目录
sudo mkdir -p /opt/cni/bin
# 创建软连接
sudo ln -sf /usr/libexec/cni/* /opt/cni/bin/

7、拉取镜像

查看官方镜像kubernetes

bash 复制代码

[jack@localhost ~]$ kubeadm config images list
I0902 15:05:13.727863    3130 version.go:256] remote version is much newer: v1.37.0; falling back to: stable-1.30
registry.k8s.io/kube-apiserver:v1.30.14
registry.k8s.io/kube-controller-manager:v1.30.14
registry.k8s.io/kube-scheduler:v1.30.14
registry.k8s.io/kube-proxy:v1.30.14
registry.k8s.io/coredns/coredns:v1.11.3
registry.k8s.io/pause:3.9
registry.k8s.io/etcd:3.5.15-0

拉取阿里云的镜像（包括flannel）

bash 复制代码

# kubernetes镜像
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.15-0
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.30.14
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.30.14
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.30.14
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.30.14
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9
sudo ctr -n k8s.io images pull registry.cn-hangzhou.aliyuncs.com/google_containers/coredns/coredns:1.11.3
# flannel镜像
sudo ctr -n k8s.io images pull ghcr.io/flannel-io/flannel:v0.28.9
sudo ctr -n k8s.io images pull ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3

8、初始化kubeadm

bash 复制代码

sudo kubeadm init \
  --kubernetes-version=v1.30.14 \
  --pod-network-cidr=10.244.0.0/16 \
  --service-cidr=10.96.0.0/12 \
  --apiserver-advertise-address=192.168.46.128 \
  --image-repository=registry.cn-hangzhou.aliyuncs.com/google_containers

说明：

kubernetes-version 版本信息，根据实际情况修改

pod-network-cidr Flannel 默认就使用 10.244.0.0/16，为了兼容 Flanne

apiserver-advertise-address Service 网络地址范围

image-repository 镜像仓库地址，避免科学上网

apiserver-advertise-address 主节点地址，此时为本机地址

成功的标志（提前下载，基本很快输出）

bash 复制代码

[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.46.128:6443 --token 9e9zp7.elq79i4ptq8luw2y \
	--discovery-token-ca-cert-hash sha256:78973d57795dae62f97faef92477f0b575a8c79943687a945fb293c372ed4c83

9、配置工具

a.普通用户

配置 kubectl 命令行工具，使其能够以当前普通用户的身份安全地访问和管理刚刚搭建好的 Kubernetes 集群

bash 复制代码

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

b.超管 root

bash 复制代码

export KUBECONFIG=/etc/kubernetes/admin.conf

10、查看状态

bash 复制代码

[jack@localhost ~]$ kubectl get nodes
NAME                    STATUS     ROLES           AGE   VERSION
localhost.localdomain   NotReady   control-plane   95m   v1.30.14

由于尚未安装网络插件，所以显示NotReady

11、安装flannel

下载地址：

bash 复制代码

https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

两种方式：

a、离线

bash 复制代码

kubectl apply -f kube-flannel.yml

b、在线

bash 复制代码

kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

正常输出

bash 复制代码

[jack@localhost ~]$ kubectl apply -f kube-flannel.yml
namespace/kube-flannel created
serviceaccount/flannel created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created

11、flannel镜像问题

如果没有提前下载，还要注意一个事情，即：kube-flannel.yml中涉及到的两个镜像

查看flannel的Events信息

bash 复制代码

kubectl get pods -n kube-flannel -o name | grep kube-flannel | xargs -r kubectl describe -n kube-flannel

结果如下：

bash 复制代码

Name:                 kube-flannel-ds-6qpmj
Namespace:            kube-flannel
Priority:             2000001000
Priority Class Name:  system-node-critical
[ 略 ] ------------------------------------------------------------------
Events:
  Type    Reason     Age    From               Message
  ----    ------     ----   ----               -------
  Normal  Scheduled  5m53s  default-scheduler  Successfully assigned kube-flannel/kube-flannel-ds-jjxkv to localhost.localdomain
  Normal  Pulling    5m53s  kubelet            Pulling image "ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3"
  Normal  Pulled     3m15s  kubelet            Successfully pulled image "ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3" in 2m37.428s (2m37.428s including waiting). Image size: 5171931 bytes.
  Normal  Created    3m15s  kubelet            Created container: install-cni-plugin
  Normal  Started    3m15s  kubelet            Started container install-cni-plugin
  Normal  Pulling    3m15s  kubelet            Pulling image "ghcr.io/flannel-io/flannel:v0.28.9"

该命令最后的Events中，会说明拉取镜像的情况，上面显示，flannel:v0.28.9还在拉取中。确认两个镜像均拉取成功，如下：

bash 复制代码

Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  13m   default-scheduler  Successfully assigned kube-flannel/kube-flannel-ds-jjxkv to localhost.localdomain
  Normal  Pulling    13m   kubelet            Pulling image "ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3"
  Normal  Pulled     11m   kubelet            Successfully pulled image "ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3" in 2m37.428s (2m37.428s including waiting). Image size: 5171931 bytes.
  Normal  Created    11m   kubelet            Created container: install-cni-plugin
  Normal  Started    11m   kubelet            Started container install-cni-plugin
  Normal  Pulling    11m   kubelet            Pulling image "ghcr.io/flannel-io/flannel:v0.28.9"
  Normal  Pulled     41s   kubelet            Successfully pulled image "ghcr.io/flannel-io/flannel:v0.28.9" in 10m39.41s (10m39.41s including waiting). Image size: 33343647 bytes.
  Normal  Created    41s   kubelet            Created container: install-cni
  Normal  Started    41s   kubelet            Started container install-cni
  Normal  Pulled     40s   kubelet            Container image "ghcr.io/flannel-io/flannel:v0.28.9" already present on machine
  Normal  Created    40s   kubelet            Created container: kube-flannel
  Normal  Started    40s   kubelet            Started container kube-flannel

如果失败，再执行

bash 复制代码

kubectl apply -f kube-flannel.yml

直到成功，或是研究国内镜像方式，我一般需要10分钟左右

查看nodes状态，已经是Ready了

bash 复制代码

[jack@localhost ~]$ kubectl get nodes
NAME                    STATUS   ROLES           AGE    VERSION
localhost.localdomain   Ready    control-plane   128m   v1.30.14

四、镜像打包下载复用

其实镜像下载较为浪费时间，可以考虑下载打包，使用时直接导入即可

查看所有的镜像（此处指的是kubernetes命名空间为k8s.io的镜像）

bash 复制代码

[jack@localhost kube-deploy]$ sudo ctr -n k8s.io images ls -q | grep -v '^sha256:'
ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3
ghcr.io/flannel-io/flannel:v0.28.9
registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:v1.11.3
registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.15-0
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.30.14
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.30.14
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.30.14
registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.30.14
registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.8
registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9

打包（镜像已压缩，无需gz）

bash 复制代码

docker save -o k8s-images.tar \
  ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel3 \
  ghcr.io/flannel-io/flannel:v0.28.9 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/etcd:3.5.15-0 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.30.14 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.30.14 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/kube-scheduler:v1.30.14 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.30.14 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9 \
  registry.cn-hangzhou.aliyuncs.com/google_containers/coredns/coredns:1.11.3

加载到环境

bash 复制代码

sudo ctr -n k8s.io images import k8s-images.tar

五、过坑的命令

bash 复制代码

# 失败重置
sudo kubeadm reset -f
sudo rm -rf /etc/kubernetes/manifests /var/lib/etcd
sudo systemctl restart containerd

# 查看官方的镜像
kubeadm config images list

# 查看ipv4转发是否开启
cat /proc/sys/net/ipv4/ip_forward

Docker、Kubernetes安装系列 二

一、导读

二、部署docker、containerd

1、部署docker

2、修改containerd配置

三、安装kube

1、初始化配置

2、加载内核模块

3、配置kubernetes网络相关

4、配置kubernetes的仓库

5、指定kubelet配置

6、containerd服务插件

7、拉取镜像

8、初始化kubeadm

9、配置工具

a.普通用户

b.超管 root

10、查看状态

a、离线

b、在线

四、镜像打包下载复用

Docker、Kubernetes安装系列二